DF-2526
trm_detach tears down DMA/IOPORT resources before bus_teardown_intr interrupt handler can execute against freed memory during detach
Summary
trm_detach releases IOPORT frees SRB SG lists and SRB array destroys sense_buffers allocation then only calls bus_teardown_intr. Interrupt fired between bus_release_resource(IOPORT) and bus_teardown_intr runs trm_Interrupt which reads/writes already-freed memory (sense_buffers via trm_get_sense_buf pFreeSRB via trm_GetSRB DCBarray). Window 3696-3710 wide open. trm_Interrupt walks pACB->pActiveDCB pDCB->pActiveSRB pSRB->pccb (points into freed SRB array) trm_get_sense_buf dereferences freed sense_buffers.
No comments yet.